Privacy Notice

1. Who is responsible for your data

The controller of personal data processed through brooksmissy.co.uk is Buniatyan Digital LLC, registered in the Republic of Armenia under state registration no. 273.110.1428053 (TIN: 02847193), registered office 10 Vazgen Sargsyan Street, Office 42, Kentron, Yerevan 0010, Armenia ("we", "us").

For anything to do with your data, write to privacy@brooksmissy.co.uk. This notice explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The short version

• Your account lives only in your browser. Nothing about it is sent to our server, so we cannot see it.
• Guests play demo games with practice credits held in the page's memory. Nothing is saved.
• We use no cookies, no advertising, no analytics and no trackers, and we load no third-party scripts, fonts or content.
• Our server stores contact-form messages (kept up to 12 months) and short-lived counters that stop the form being flooded (kept for one hour).
• We never sell personal data and we do not share it with anyone except our hosting provider, who stores it for us.

3. Data kept on your device

When you create an account, the site's code stores it in your browser's local storage, on your device. It contains:

• your email address, player name, first name and (if you give it) last name;
• your date of birth and the part of the UK you live in, which we ask for to check that you are 18 or over and live in the UK;
• your password and recovery key, stored only as PBKDF2-SHA-256 hashes, never as text;
• your Pebbles balance, level, experience and Club tier, the number of rounds you have played in each game, your favourites and recently played games;
• your progress in the Holt (Lily Wheel, Skim cards, Errands and the Weir meter);
• your player care settings (time reminder and any break you have taken) and your sound setting.

The browser also keeps a few small notes: which account is signed in, a count of failed sign-in attempts, your answer to the age question and your cookie choice. Our Cookie Policy lists every one of these storage keys, what it holds and how long it lasts.

None of this is transmitted to us. It stays on your device until you delete your account, sign out, or clear this site's data in your browser. Because we never receive it, we cannot read it, correct it, back it up or restore it.

4. Messages you send us

If you use the contact form, our server stores your name, your email address, the topic you chose, your message, and the IP address and time it was sent. If you email us directly, we receive your email address and whatever you write. We use these details only to read and answer your message, and to deal with abuse of the form.

5. Server records and security

Like every website, our server receives your IP address and basic request details (such as the page asked for, the time and your browser type) whenever you load a page. We do not use these details to identify you, build a profile or track you across sites.

To stop the contact form being flooded, the server keeps a short-lived counter for each IP address that has used it. The counter holds the IP address only in hashed form, together with the times of recent requests, and is cleared after one hour. Our hosting provider may also keep standard web server logs for security and fault-finding, for a limited period.

6. Why we use data and our lawful bases

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum. We make no decisions about you by automated means that have legal or similarly significant effects.

7. How long we keep it

• Contact-form messages: up to 12 months, then deleted. We delete them sooner if you ask and we no longer need them.
• Rate-limit counters: one hour.
• Hosting provider's web server logs: for a limited period, for security only.
• Data on your device: until you delete it. You are in control; we have no copy.

8. Who we share it with

We do not sell, rent or trade personal data, and we do not share it with advertisers, analytics companies or data brokers. The only other party involved is our web hosting provider, which stores the server data for us as a processor, under a contract that allows it to act only on our instructions. We would disclose data to others only if the law required it, for example to answer a valid request from the police or a court.

9. International transfers

Data on your device does not travel anywhere. Brooksmissy is hosted in the United Kingdom, so the messages you send through the contact form and our server records are stored on servers in the UK. Buniatyan Digital LLC is based in Armenia, and when we read those messages or records from there, that access counts as a transfer outside the UK. Armenia is not covered by UK adequacy regulations, so we make that transfer under the safeguards UK GDPR requires, such as the UK International Data Transfer Agreement or Addendum. You can ask us for details at privacy@brooksmissy.co.uk.

10. How we protect it

The site is served over HTTPS. Passwords and recovery keys are hashed in your browser with PBKDF2-SHA-256 and a random salt before they are stored. Contact messages are stored in protected files on the server that cannot be opened from the web. Please help by keeping your device locked, signing out on shared devices and keeping your recovery key private.

11. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data;
• ask us to restrict how we use it, or object to our use of it where we rely on legitimate interests;
• ask for data you gave us in a portable format;
• withdraw consent at any time, where we rely on consent.

For contact messages and server records, write to privacy@brooksmissy.co.uk. We will reply within one month; if a request is complex, we may extend this by up to two further months and will tell you why. We may need to confirm your identity first, usually by replying to the email address the message came from.

For your account, you do not need to ask us: the data is already in your hands. You can see your details on your account page, delete the account there, and clear everything else by clearing this site's data in your browser. You can change your cookie choice at any time with the Cookie settings link at the foot of every page.

12. Complaints and the ICO

If you are unhappy with how we have handled your data, please tell us first at privacy@brooksmissy.co.uk so that we can try to put it right. We will acknowledge your complaint within 30 days and keep you updated.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: online at ico.org.uk, or by phone on 0303 123 1113.

13. Children

Brooksmissy is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18, and the sign-up form refuses a date of birth under 18. If you think a child has sent us a message, write to us and we will delete it.

14. Changes to this notice

We will update this notice if the way we handle data changes, for example if we ever add a feature that sends data to our server. The date at the top shows the latest version. We will never start using trackers or advertising without updating this notice and our Cookie Policy first, and asking for your consent where the law requires it.